Why your business emails go to junk, and how to fix it

The three settings that matter

When your email arrives, Gmail, Outlook and the rest check whether it really came from you. They do that by reading three records in your domain's DNS settings:

• SPF is a list of the services allowed to send email as your domain, such as Microsoft 365, Google Workspace, your website or your invoicing software. If a service that sends your email isn't on the list, your emails look forged.
• DKIM is a digital signature added to each email, proving it wasn't changed on the way. Your email provider gives you the record to add.
• DMARC checks whether a passing SPF or DKIM identity aligns with the domain in the visible From address. It publishes your requested policy for failures and can request reports. Gmail requires SPF, DKIM and DMARC for senders exceeding 5,000 messages a day to personal Gmail accounts.

The mistakes we see most

• A service missing from SPF. You moved to Google Workspace or Microsoft 365, or started sending invoices from an app, and nobody updated SPF. We found exactly this gap on our own domain in September 2026: Google wasn't in our SPF record. It took two minutes to fix.
• Two SPF records. A domain must have only one. Two means both are treated as broken.
• Too many lookups. SPF allows a maximum of 10 DNS lookups. Keep adding services and it can quietly go over the limit and fail.
• No DKIM. Many providers need you to switch it on and add the record yourself.
• A brand-new domain. Even with perfect settings, a domain a few weeks old has no reputation yet. Send small volumes to people likely to reply, and build up slowly.

Start with a domain check

Our free email check reads your domain's public settings (MX, SPF including nested includes, DKIM and DMARC) and tells you in plain English what's missing. No sign-up.

How to fix it

1. List everything that sends email as your domain: your mailbox provider, website contact form, invoicing, booking and newsletter tools.
2. Make sure each one is included in a single SPF record.
3. Switch on DKIM in each service and add the DNS records it gives you.
4. For a new DMARC rollout, start with p=none and configure an aggregate-report address using rua. Review legitimate sending services before moving to quarantine or reject. Do not weaken an existing enforced policy just to follow this example.
5. Send a test to a Gmail and an Outlook address and check it lands in the inbox.

Authentication passes, but messages still go to junk?

Send a test from each service you use, including your website’s contact form. In Gmail, open the message menu and choose Show original to inspect the authentication results. Check the sender shown in the From field as well as SPF, DKIM and DMARC.

If authentication passes, check recipient consent, complaint levels and sending patterns. An inbox test is evidence for that message, not a guarantee for every future email. For newsletters, provide a working unsubscribe option.